An organization's security team wants to understand which Microsoft Copilot for Security capabilities require Security Compute Units (SCUs) versus which are included in existing Microsoft licenses. A new analyst asks about the billing model. What is the correct understanding?

The correct understanding is that the standalone Copilot for Security portal at securitycopilot.microsoft.com requires provisioned Security Compute Units, while embedded Copilot experiences in products such as Microsoft Defender XDR or Microsoft Intune may be included in those product licenses without additional SCU consumption. The claim that all features are included in Microsoft E5 Security licenses at no additional cost is incorrect because the standalone experience still depends on SCU provisioning. The per-user-per-month billing claim with a minimum of 10 users is incorrect because Security Copilot uses capacity-based SCUs rather than traditional per-user licensing. The claim that SCUs are consumed only when Copilot queries external threat intelligence sources is incorrect because SCUs are consumed by Copilot for Security workloads and queries generally, not only external threat intelligence lookups.